[Unit]
Description=agentcage mitmproxy
Requires={{ name }}-dns.service
After={{ name }}-dns.service

[Container]
ContainerName={{ name }}-proxy
Image=localhost/agentcage-proxy
Network={{ name }}-net.network:ip=10.89.0.11
Network=podman
{% for srv in dns_servers %}
DNS={{ srv }}
{% endfor %}
Volume={{ config_host_path }}:/etc/agentcage/config.yaml:ro,Z
Environment="PYTHONUNBUFFERED=1"
Volume={{ name }}-certs.volume:/home/mitmproxy/.mitmproxy:Z
{% if capture_enabled %}
Volume={{ capture_host_dir }}:/var/log/agentcage/capture:Z
Environment="AGENTCAGE_CAPTURE=/var/log/agentcage/capture/capture.jsonl"
{% endif %}
{% if inbound_forwards %}
Exec=mitmdump -s /app/addon.py --mode regular@10.89.0.11:8080{% for fwd in inbound_forwards %} --mode reverse:http://10.89.0.2:{{ fwd.container_port }}@0.0.0.0:{{ fwd.container_port }}{% endfor %} --set connection_strategy=lazy --set keep_host_header=true{% if not log_proxy_connections %} --set flow_detail=0{% endif %}

{% for fwd in inbound_forwards %}
PublishPort={{ fwd.publish_spec }}
{% endfor %}
{% else %}
Exec=mitmdump -s /app/addon.py --listen-port 8080 --set connection_strategy=lazy --listen-host 10.89.0.11{% if not log_proxy_connections %} --set flow_detail=0{% endif %}

{% endif %}
{% for secret in proxy_secrets %}
{% if deploy_name %}
Secret={{ deploy_name }}.{{ secret }},type=env,target={{ secret }}
{% else %}
Secret={{ secret }},type=env
{% endif %}
{% endfor %}

[Service]
ExecStartPre=/bin/bash -c 'mp=$(podman volume inspect agentcage-certs-{{ name }} --format "{{"{{"}}.Mountpoint{{"}}"}}") && podman unshare chown 1000:1000 "$mp"'
ExecStartPost=/usr/bin/podman exec --user root {{ name }}-proxy sh -c "printf '{% for srv in dns_servers %}nameserver {{ srv }}\n{% endfor %}' > /etc/resolv.conf"
Restart=on-failure

[Install]
WantedBy=default.target
